A week in security (Dec 6 – 12)

Last week on Malwarebytes Labs: Log4j zero-day “Log4Shell” arrives just in time to ruin your weekend Click “OK” to defeat MFA Fake job interviews plague major game developers like Riot Games and Rockstar Has your WordPress site been backdoored by a skimmer? What is a search engine and why does...

CRLF Injection

phpservermon/phpservermon is vulnerable to CRLF injection. The vulnerability exists because of the misconfiguration in nginx that allows a malicious attacker to gain CSRF token and set fake cookies...

Attacker can empty all the funds by creating fake promotions

Handle WatchPug Vulnerability details The current implementation of calculateRewardAmount allows a arbitrary epochId, which can even be a epochId numberOfEpochs. A malicious user can call claimRewards with epochIds larger than numberOfEpochs and claim other users' rewards. Furthermore, since...

Strategy can steal all the funds in ERC20Vault by rebalancing with a fake token in path

Handle WatchPug Vulnerability details PoC Given: A pool with 100 ETH and 40,000 USDC; A malicious or compromised Strategy can do the following: 1. Create a FAKE token, and add liquidity to ETH/FAKE and FAKE/USDC, making the price of ETH/FAKE to be 1 ETH per FAKE and the price of FAKE/USDC is 0.01...

CVE-2021-37048

There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to fake visitors to control PC,play a video,etc...

CVE-2021-37048

There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to fake visitors to control PC,play a video,etc...

Input validation

There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to fake visitors to control PC,play a video,etc...

CVE-2021-37048

There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to fake visitors to control PC,play a video,etc...

Fake KPSPico Windows activator tool KPSPico steals crypto wallet data

By Waqas Watch out for fake and malicious KMSPico Windows activator used in spreading CrypBot malware to steal crypto wallets' data. This is a post from HackRead.com Read the original post: Fake KPSPico Windows activator tool KPSPico steals crypto wallet data...

Malvertising attack distributes malicious Chrome extensions, backdoors

By Waqas Researchers believe that the campaign has been active since 2018, and since then, the malware has been under development constantly. Cisco Talos researchers have identified malvertising campaigns using fake installers of popular games and applications, such as WeChat, Viber, Battlefield,...

Remote access tools abused to spread malware and steal cryptocurrency

By Waqas The new campaign also involves replacing cryptocurrency addresses shared via clipboard and setting up fake cryptocurrency websites. This is a post from HackRead.com Read the original post: Remote access tools abused to spread malware and steal cryptocurrency...

Campaign Abusing Legitimate Remote Administrator Tools Uses Fake Cryptocurrency Websites

We have been tracking a campaign involving the SpyAgent malware that abuses well-known remote access tools RATs for some time now. While previous versions of the malware have been covered by other researchers, our blog entry focuses on the malicious actor’s latest attacks...

FakeDataGen - Full Valid Fake Data Generator

FakeDataGen is a Full Valid Fake Data Generator. This tool helps you to create fake accounts in Spanish format with fully valid data. Within this information, you can find the most common names, emails, bank details and other useful information. Requirements Python 3 Install requirements.txt...

IT threat evolution Q3 2021

IT threat evolution Q3 2021 IT threat evolution in Q3 2021. PC statistics IT threat evolution in Q3 2021. Mobile statistics Targeted attacks WildPressure targets macOS Last March, we reported a WildPressure campaign targeting industrial-related entities in the Middle East. While tracking this...

Please don’t buy this! 3 gift card scams to watch out for this holiday season

With the holiday season around the corner, we thought it was a good time to look at the dangers that come with gift cards. Gift cards can be an easy win in cases where you don’t know the receiver well enough to decide on a fitting gift, or when their wishes are out of your price range. But there...

Fake ransomware warnings hit WordPress sites: How to stay safe

A ransomware warning has appeared out of nowhere and started taking over WordPress sites. The warning, with its black background and red writing, says: “SITE ENCRYPTED Countdown FOR RESTORE SEND 0.1 BITCOIN: address redacted create file on site /unlock.txt with transaction key inside” But theres...

FBI Email Hoaxer ID’ed by the Guy He Allegedly Loves to Torment

Vinny Troia, the cybersecurity researcher mentioned in a fake alert gushed out to thousands of people from the FBI’s own email system on Friday night, has fingered the guy who allegedly pulled off the exploit. Register now for our LIVE event! Troia – white hat threat hunter, cybercrime investigat...

Hacker accessed FBI server to send fake email threats

By Waqas The FBI has categorically denied sending spam emails from its server, which according to reports, hit 100,000 inboxes. This is a post from HackRead.com Read the original post: Hacker accessed FBI server to send fake email threats...

FBI server hijacked to send up to 100,000 bogus attack mails

If you received a scary missive from what appears to be from the FBI over the last few days, youre not alone. The emails, which may have reached as many as 100,000 people, blamed a fictitious cyberattack on an innocent party. The mail read as follows: Our intelligence monitoring indicates...

Siemens Nucleus ReadyStart Type Obfuscation Vulnerability

Siemens Nucleus ReadyStart is a bundled solution from Siemens, Germany. It is used to accelerate the fast startup of complete systems and provides a rich set of board support packages Bsp. A security vulnerability exists in Siemens Nucleus ReadyStart, which originates from an ICMP echo packet wit...